EP2193406B1 - Method for the access control to an automation unit - Google Patents

Abstract

In a method for the access control to an automation unit (01), access rights predetermined by the access control are dependant on the operating state of the automation unit (01), wherein at least during an emergency, expanded access rights in relation to normal operation are granted independently of the access rights during normal operation.

Description

With the advent of information technology (IT) in automation and the increasing integration with office environments also increases the need for security solutions for automation environments. Access control is an essential security functionality that determines and enforces who can perform what actions. For example, it can be determined which accesses by operating personnel can be made to operate and observe a process or production or a process or production process.

Three key pillars of IT security are confidentiality, integrity and availability. In terms of typical office environments, confidentiality and integrity of data usually plays the most important role. In the automation environment, however, availability is more important than the confidentiality of the data. Usually, hardly any high-secret data is transmitted over the network, but mainly control and status commands.

Due to the environment of use, special boundary conditions must be taken into account. For example, in a process automation environment, a manufacturing process / process industry may not simply stop a physical process, such as heating and stirring an adhesive, in a security emergency in plant control. Similarly, in an emergency, such as overheating of the adhesive by IT security measures may not be prevented intervention by operating personnel. Tightly set access rights, as is desirable from the point of view of IT security, must not result in such a situation Emergency required manual interventions are prevented or made unnecessarily difficult.

Known is a role-based access control (RBAC, Role Based Access Control). In practice, this is often understood as merely a role-based administration of access rights. Groups are defined according to the tasks involved. Access rights are assigned to individual groups. Individual employees are assigned to the groups corresponding to their tasks and thus receive the access rights required for their task.

From the theoretical point of view, RBAC means that a single employee perceives different tasks at different times, and assumes different roles at different times. If the tasks of the employee change between several points in time, he carries out a role change in order to receive the access rights assigned to the currently perceived role.

Out EP1621944 A2 a method for access control to an automation system is known in which predetermined by the access control access rights depend on the operating state of the automation system.

By Covington et al "Securing Context-Aware Applications Using Environment Roles", Proceedings of the Sixth ACM Symposium on Access Control Models and Technologies, Chantilly, Va., United States, pp. 10-20, 2001, ISBN: 1-58113-350- 2 In addition, a context-based access control in the care and monitoring of elderly people at home is known, in which access rights are dependent on context information, also referred to as environment information. This contextual or contextual information relates to the time of day, the day of the week, the whereabouts, or the current status of a workflow. The access rights are assigned to specific environment roles. Different environment roles can be triggered by context information. Activation of an environment role can trigger an action automatically. For example, an emergency call is automatically established when the environment role "violated" is activated.

As an object of the invention, it may be considered to provide access control better adapted to an automation environment.

The object is achieved by the features of claim 1.

An inventive method for access control on an automation system provides that predetermined by the access control access rights depend on the operating state of the automation system, at least in an emergency, regardless of the access rights in normal operation extended access rights are granted as in normal operation.

Providing emergency access with extended access rights, at least in emergencies, enables fast and flexible action that is not hampered or unnecessarily hindered by IT security measures.

Advantages of the invention over the prior art arise in particular from the fact that for the regular, operational operation of the automation system access rights can be set restrictive according to the requirements of regular operation. For special operating conditions, especially in an emergency, correspondingly extended access rights are granted.

In principle, roles are defined that correspond to the different operating states of an automation system. There is no random role change as with RBAC, but the access rights depend on the operating status. In normal operation, a high degree of security is achieved and access rights can be set restrictive, since only in a special operating state, such as during maintenance or in an emergency, then needed, extended access rights are granted. This can too is considered to be a kind of override functionality that under certain circumstances can override access control.

Furthermore, the management of access rights is simplified, since only the access rights for normal operation must be specified exactly and narrowly. In special circumstances, extended access rights are granted under the assumption that qualified and trusted operating and maintenance personnel do not abuse access rights under such circumstances. This trust is based on the fact that there is a high level of responsibility towards the operator and maintenance personnel anyway, as it has to perform maintenance tasks such as tool change or calibration or a controlled shutdown of a process that is not or not fully automated.

An advantageous embodiment of the invention provides that the automation system is monitored to detect the operating state. The monitoring can take place automatically by means of suitable sensors or be carried out by operating and maintenance personnel.

Preferably, an emergency is triggered automatically as soon as certain process variables of the automation system exceed predetermined limit values. It is also conceivable that an emergency is triggered manually by the operating and monitoring personnel.

An advantageous embodiment of the invention provides that the access rights are set tightly in normal operation in order to avoid incorrect operation and unauthorized access.

Another advantageous embodiment of the invention provides that the access rights are defined role-based in normal operation.

A further advantageous embodiment of the invention provides that in normal operation to obtain access rights and / or to obtain additional and / or other access rights, an identification of the accessing or authentication is performed for example by a log-in procedure. The log-in procedure can be configured as desired, for example by input of user name and / or password, by an authentication token, such as by means of a chip card or wirelessly, or by a fingerprint or other biometric identification.

An additional advantageous embodiment of the invention provides that when an emergency occurs, an alarm is triggered for automatic alerting and activation of emergency measures, for example, emergency crews can confirm the emergency.

A particularly advantageous embodiment of the invention provides that, at least during an emergency or in an operating state in which extended access rights are granted, the actions and accesses made by an operating and maintenance personnel are recorded for example by a video camera and / or for example on a logging Servers are logged. If necessary, access rights can be exceeded if required. However, this is recorded both by recording and logging the accesses made, as well as by activating a video surveillance and it can be checked whether this actually happened for legitimate reasons.

An advantageous embodiment of the invention provides that at least in an emergency, a special emergency safety mode is provided in which the intended for normal operation hard or tight control and allocation of access rights is replaced by softer measures that are, however, subsequently evaluated or be evaluated. The replacement of harsh security measures in normal operation by soft security measures in one Emergency enables all necessary measures to be carried out by operating and monitoring personnel. Abuse is nevertheless prevented because the fact of the emergency triggering as well as the actions taken and the accesses are subsequently traceable.

Preferably, the softer measures include granting extended access rights and / or optionally disabling the control and granting of access rights, thereby allowing all actions and accesses.

Alternatively, it is conceivable that the softer measures include a waiver of an authentication, for example by log-in, so that everyone can use an automation system controlling control and monitoring device.

For subsequent evaluation of the softer measures is preferably a recording and logging the accesses made. This can be done on the operating and monitoring device itself or on a specially provided for this purpose, for example in an emergency-proof, such as fireproof and / or explosion-proof space housed logging server.

For the subsequent evaluation of the softer measures, for example, an activation of a video surveillance or activating a video recording can take place in order to determine from the recorded video material who has triggered the emergency security mode and who has performed which accesses or actions.

The emergency security mode preferably comprises a plurality of sub-levels with different access rights, which can be activated or activated step-by-step. Since possibly even slightly higher access rights are sufficient to be able to fend off the worst in an emergency, as a first aid, the emergency safety mode preferably comprises several sub-levels. These can be activated step by step. In a first emergency activation stage, for example, only the most necessary rights can be granted, for example to delay an imminent emergency and initiate simple countermeasures. If further measures are necessary to prevent the emergency, then also a second emergency activation stage must be activated, which grants even more extensive, for example unrestricted access. For example, it is conceivable that permanent configuration changes can also be made. The activation of such a second emergency activation stage can then be more elaborately protected than that of the first emergency activation stage. Thus, for example, it is conceivable that the first emergency activation stage can be activated by mouse click on the user interface of the operating and monitoring device, and the second emergency activation stage only via a physical safety switch, which can be actuated for example only after driving a protective screen.

An activation of the emergency safety mode can be done manually, for example by pressing a special button on a graphical user interface. So that activation of the emergency safety mode for convenience in regular operational operation is omitted, this is a special button on a graphical user interface provided by the actuation of a manual change to the emergency safety mode. In this case, the manual change to the emergency safety mode can be accessible to all employees, or only to certain authenticated employees, for example only to the foreman or the foreman.

Alternatively, manual activation of the emergency safety mode may be accomplished by operation of a physical safety switch. Such a physical safety switch may, for example, be a key switch, or a push-button with impact disk, as is known, for example, from fire detectors, or two spatially remote switches, which must be operated by at least two people preferably simultaneously. In the latter case, both switches can be mounted on the automation system, but at such a distance that they can not be operated simultaneously by one person alone. The two switches can also be arranged spatially separated from one another so that a switch, for example, attached to the automation system itself and the second switch in a remote security center.

The physical switch can be coupled with a fire or alarm button, which in addition an alarm occurs when actuated, such as a plant fire brigade.

Furthermore, it is conceivable that a manual activation of the emergency security mode takes place by a special log-in procedure, for example an input of a special emergency password or use of a special emergency authentication token, such as an emergency chip card.

An activation of the emergency safety mode is preferably carried out automatically depending on the operating state of the automation system. For this purpose, certain parameters of the automation system are monitored and, for example, automatically determined by comparison with predetermined limits for these parameters, whether a normal operating state, or an emergency exists. In process engineering automation systems, for example, pressure and temperature can be measured by suitable, preferably redundantly arranged sensors, which can be automatically monitored and determined by comparison with established limits, such as a maximum maximum temperature, a maximum allowable maximum pressure, a minimum temperature, a minimum pressure, and if the measured values for pressure and temperature in the automation system when performing a specific Process process within a certain allowable operating range, ie a normal operating condition is present or not, so there is an emergency. Alternatively, the engine speed can be monitored and compared with setpoints.

The emergency safety mode may persist after activation until it is manually deactivated again, for example by actuating a switch or the like.

Alternatively, it is conceivable that the emergency security mode is automatically deactivated again after the activation after a certain predetermined period of time.

Likewise, the emergency safety mode can be automatically deactivated after activation after averting an emergency, for example when the measured values detected by sensors are again within a permissible operating range.

Furthermore, it is conceivable that the emergency safety mode remains activated only as long as a corresponding activation switch or the like is kept pressed or operated.

Fig. 1

eine schematische Darstellung einer Automatisie- rungsanlage.

The invention will be explained in more detail with reference to an embodiment shown in the drawing. It shows:

Fig. 1

a schematic representation of an automation system.

An in Fig. 1 illustrated automation system 01 comprises a stirrer 02 which is driven by a motor 03. The stirrer 02 stirs a substance in a container 04. The container 04 contains a heater 05 and a temperature sensor 06, which are both connected to a process computer 07. Pipelines for transporting the substance into and out of the container 04 are not shown. The process computer 07 is connected to an operating and monitoring device 08. The operating and monitoring device 08 is connected to an emergency switch 09, a video camera 10, and a logging server 11. The operating and maintenance staff 12 monitors and controls the process of stirring the substance in the container 04 via the operating and monitoring device 08. In the event of an intermediate or emergency, the operating and maintenance personnel 12 actuates the emergency switch 09, whereupon the operator and maintenance personnel 12 unrestricted access rights and thus unrestricted access receives. At the same time, however, the actions and accesses made by the operating and maintenance personnel 12 are recorded by the video camera 10 and logged on the logging server 11.

According to the invention, a close access control is carried out for the regular operation of an automation system with an operating and monitoring device, in which the operating personnel must authenticate, for example by a log-in, and can only access the operating and monitoring device, which also uses a defined access control policies are allowed. The aim is less to achieve high confidentiality of the transmitted automation data, but rather to avoid incorrect operation and unauthorized access. The log-in procedure can be configured as desired, for example by input of user name and / or password, by an authentication token, such as by means of a chip card or wirelessly, or by a fingerprint or other biometric identification.

In order to be able to react appropriately in emergencies, which can naturally contain unforeseeable aspects, extended access rights are necessary there. According to the invention, extended access rights are granted in emergencies. It allows a fast and flexible action that is not hindered or unnecessarily complicated by IT security measures.

For this purpose, a special emergency safety mode / a special emergency safety configuration is provided.

• Gewähren erweiterter Zugriffsrechte und/oder gegebenenfalls Deaktivieren der Zugriffskontrolle, wodurch alle Zugriffe erlaubt werden.
• Verzicht auf Authentisierung beispielsweise durch Log-In, wodurch jeder die Bedien- und Überwachungseinrichtung nutzen kann.
• Aufzeichnen und Protokollieren der vorgenommenen Zugriffe, so genanntes Logging. Dies kann auf der Bedien- und Überwachungseinrichtung selbst oder auf einem eigens hierfür vorgesehenen, beispielsweise in einem notfallfesten, beispielsweise feuersicheren und/oder explosionssicheren Raum untergebrachten Logging-Server durchgeführt werden.
• Aktivierung einer Video-Überwachung bzw. Aktivieren einer Video-Aufzeichnung, um so anhand des aufgezeichneten Video-Materials festzustellen, wer den Notfall-Sicherheitsmodus ausgelöst hat und wer welche Zugriffe bzw. Aktionen durchgeführt hat.
• Auslösung eines Alarms, damit Einsatzkräfte den Notfall bestätigen können.

The access control provided for normal operation or regular operation is replaced by softer measures, which, however, can be evaluated later:

• Providing extended access rights and / or disabling access control, allowing all access.
• No authentication, for example through log-in, which allows everyone to use the operating and monitoring device.
• Recording and logging of the accesses, so-called logging. This can be done on the operating and monitoring device itself or on a specially provided for this purpose, for example, in an emergency-proof, such as fireproof and / or explosion-proof space housed logging server.
• Enable video surveillance or enable video recording to determine who has triggered the emergency security mode and who has taken which access or actions based on recorded video material.
• Triggering an alarm so emergency personnel can confirm the emergency.

The replacement of hard safety measures in normal operation with soft safety measures in an emergency enables all necessary measures to be carried out by operating and monitoring personnel. Abuse is nevertheless prevented because the fact of the emergency triggering as well as the actions taken and the accesses are subsequently traceable.

If necessary, access rights can be exceeded if required. However, this is done both by recording and logging the accesses, as also by the activation of a video surveillance detained and it can be checked whether this actually happened for legitimate reasons.

Since possibly even slightly higher access rights are sufficient to be able to fend off the worst in an emergency as a first aid, the emergency security mode can comprise several sub-levels. These can be activated step by step. In a first emergency activation stage, for example, only the most necessary rights can be granted, for example to delay an imminent emergency and initiate simple countermeasures. If further measures are necessary to prevent the emergency, then also a second emergency activation stage must be activated, which grants even more extensive, for example unrestricted access. For example, it is conceivable that permanent configuration changes can also be made. The activation of such a second emergency activation stage can then be more elaborately protected than that of the first emergency activation stage. Thus, for example, it is conceivable that the first emergency activation stage can be activated by mouse click on the user interface of the operating and monitoring device, and the second emergency activation stage only via a physical safety switch, which can be actuated for example only after driving a protective screen.

The change to the emergency safety mode can be done in different ways. It is important that the special meaning is clear and thus an activation for convenience in regular operations is omitted.

A first variant, which ensures that activation of the emergency safety mode for convenience in regular operational operation is omitted, can be achieved, for example, by means of a special button on a graphical user interface, the actuation of which results in a manual change to the emergency safety mode. there For example, the manual switch to Emergency Security Mode may be accessible to all employees, or only to certain authenticated employees, such as the foreman or foreman only.

A second variant, which ensures that activation of the emergency safety mode is omitted for convenience in regular operational operation, is a use of a physical safety switch to activate the emergency safety mode. Such a physical safety switch can be, for example, a key switch, or a push-button with an impact disk, as is known, for example, from fire detectors, or two spatially remote switches, which must preferably be actuated simultaneously by at least two people. In the latter case, both switches can be mounted on the automation system, but at such a distance that they can not be operated simultaneously by one person alone. The two switches can also be arranged spatially separated from one another so that a switch, for example, attached to the automation system itself and the second switch in a remote security center. The physical safety switches described can be coupled with a real fire or alarm button, which in addition an alarm occurs when actuated, such as a plant fire brigade.

A third variant, which ensures that activation of the emergency security mode is omitted for convenience in regular operational operation, provides a special log-in procedure, such as entering a special emergency password or using a special emergency authentication token, such as a emergency smart card.

A fourth variant which ensures that activation of the emergency safety mode for convenience in regular operational operation is omitted, is automatically dependent on the operating state of the automation system. This will be certain Monitored parameters of the automation system and automatically determined, for example, by comparing with predetermined limits for these parameters, whether a normal operating condition, or an emergency exists. In process engineering automation systems, for example, pressure and temperature can be measured by suitable, preferably redundantly arranged sensors, which can be automatically monitored and determined by comparison with established limits, such as a maximum maximum temperature, a maximum allowable maximum pressure, a minimum temperature, a minimum pressure, and if the measured values for pressure and temperature in the automation system in the implementation of a particular process process are within a certain permissible operating range, ie a normal operating state exists or not, so there is an emergency.

The emergency safety mode either remains permanently after activation until it is manually deactivated again, for example by actuating a switch or the like, or it is automatically deactivated again after a certain predetermined period of time. The emergency safety mode can be deactivated automatically even after an emergency has been averted, for example if the measured values recorded by sensors are again within the permissible operating range. As a further possibility, it is conceivable that the emergency safety mode remains activated only as long as a corresponding activation switch or the like is actuated or kept actuated.

Claims (27)

1. Method for access control to an automation plant (01), wherein,
   access rights predetermined by the access control are dependent on the operating state of the automation plant (01),
   characterised in that at least during an emergency extended access rights are granted independently of the access rights in normal operation.
2. Method according to claim 1,
   characterised in that,
   in order to detect the operating state, the automation plant (01) is monitored.
3. Method according to claim 2,
   characterised in that,
   monitoring takes place automatically by means of suitable sensors (06).
4. Method according to claim 2,
   characterised in that,
   monitoring is carried out by operating and maintenance personnel (12).
5. Method according to one of the preceding claims,
   characterised in that,
   an emergency is automatically triggered as soon as specific process variables of the automation plant (01) exceed predetermined limit values.
6. Method according to one of claims 1 to 4,
   characterised in that,
   an emergency is triggered manually.
7. Method according to one of the preceding claims,
   characterised in that,
   the access rights in normal operation are tightly specified in order to prevent incorrect operation and unauthorised access.
8. Method according to one of the preceding claims,
   characterised in that,
   in normal operation the access rights are specified in a role-based manner.
9. Method according to one of the preceding claims,
   characterised in that,
   in normal operation, in order to obtain access rights and/or to obtain additional and/or other access rights, identification of the accessing party or authentication is carried out.
10. Method according to one of the preceding claims,
    characterised in that,
    when an emergency occurs an alarm is triggered for automatic signalling and activation of emergency measures.
11. Method according to one of the preceding claims,
    characterised in that,
    at least in an emergency the actions taken and access effected by operating and maintenance personnel (12) are recorded and/or logged.
12. Method according to one of the preceding claims,
    characterised in that,
    at least in an emergency a special emergency safety mode is provided in which the tight control and allocation of access rights provided for normal operation is replaced by softer measures which can be or are evaluated later.
13. Method according to claim 12,
    characterised in that,
    the softer measures include the granting of extended access rights and/or deactivation of the control and allocation of access rights, which permits all operations and access attempts.
14. Method according to claim 12,
    characterised in that,
    the softer measures include dispensing with an authentication, whereby anyone can use an operating and monitoring unit (08) that is controlling the automation plant (01).
15. Method according to claim 12, 13 or 14,
    characterised in that,
    recording and logging of the access attempts is implemented for later evaluation of the softer measures.
16. Method according to one of claims 12 to 15,
    characterised in that,
    video monitoring (10) or video recording is activated for later evaluation of the softer measures.
17. Method according to one of claims 12 to 16,
    characterised in that,
    the emergency safety mode includes a plurality of sublevels with different access rights, which can be or are incrementally activated.
18. Method according to one of claims 12 to 17,
    characterised in that,
    activation of the emergency safety mode is effected manually.
19. Method according to claim 18,
    characterised in that,
    activation of the emergency safety mode is implemented by actuation of a special switch surface on a graphical operator interface.
20. Method according to claim 18,
    characterised in that,
    activation of the emergency safety mode is implemented by actuation of a physical safety switch (09).
21. Method according to claim 20,
    characterised in that,
    the physical switch (09) is coupled to a fire or alarm button.
22. Method according to claim 18,
    characterised in that,
    activation of the emergency safety mode is implemented by a special log-in procedure.
23. Method according to one of claims 12 to 17,
    characterised in that,
    activation of the emergency safety mode is automatically implemented dependent on the operating state of the automation plant (01).
24. Method according to one of claims 12 to 23,
    characterised in that,
    after activation the emergency safety mode remains in force until it is manually deactivated again.
25. Method according to one of claims 12 to 23,
    characterised in that,
    after activation the emergency safety mode is automatically deactivated again on expiration of a certain predetermined time interval.
26. Method according to one of claims 12 to 23,
    characterised in that,
    after activation the emergency safety mode is automatically deactivated after an emergency has been averted.
27. Method according to one of claims 12 to 23,
    characterised in that,
    the emergency safety mode remains activated only for as long as a corresponding activation switch (09) is actuated.

Images